Whenever you're ready, walk me through how you'd approach this.
What are the most critical security controls you would implement for a new web-facing application?
